TP-Link TD-W8960N

300Mbps Wireless N ADSL2+ Modem Router

Forum discussion here

OEM source code available at: TD-W8960Nv1.0_RELEASE_GPL_CODE.tar.gz

For TD-W8960N v5 see TP-Link TD-W8960N v5 and Plusnet 2704N V1

(for version 1 and version 3)

CPU Ram Flash Network Wireless NIC Wireless Standard USB Serial JTag ADSL2+ Modem
BCM6358@300MHz 32 MB 4 MB 4x 100mbps BCM4351 (onboard) b/g/n NO YES YES YES

Install OpenWrt (generic explanation)

NOTE: Using a stable build from LEDE 17.01.4 will work with your router but the WiFi drivers do not load with the firmware. Manually adding the drivers does not seem to work because the device loads incorrect drivers for the WiFi at the boot. (Tested with LEDE 17.01.4 - V3 router).

  1. Download the latest Stable (see table above) or Openwrt LEDE 17.01.4 and 'kmod-b43legacy' package for Wi-Fi drivers.
  2. Use a tftp CLIENT to upload the image (for example tftpd32.exe on windows)
  3. Give your PC a static IP and telnet the router
  4. Use the command:
    tftp -g -t i -f openwrt-cfe.bin

    Where “openwrt-cfe.bin” is the filename and “” is the IP of the PC where to get the file from tftp server (Thanks to mbo2o @ LEDE Forum for the firmware upload instructions)

  5. Wait for it to flash, router will reboot automatically and enter in recovery mode
  6. Go to and reflash the openwrt-96358VW2-generic-squashfs-cfe.bin image
  7. The router should now boot to openwrt

Alternative mode (you have to open the router case):

  1. Flash using a Serial TTL adapter and CFE bootloader.
  2. Setup a TFTP server on your computer.
  3. Using the serial connection, stop the boot process by pressing any key when asked
  4. Once you are on the CFE prompt do “flashimage hostip:image.bin” (example CFE > flashimage
  5. The device should automatically reboot to OpenWrt

You will need an active serial connection!

  1. Download the latest firmware from the TP-LINK servers
  2. Using an hex-editor remove everything from offset 00000000 to 000001FF (this means that now the 1st character of the firmware is a 6 (or 36 in BIN))
  3. Save that modified original image
  4. Go to the CFE prompt and do “flashimage hostip:image.bin”
  5. The device should automatically reboot to original tplink firmware
Architecture MIPS
Vendor Broadcom
bootloader cfe
Board ID 96358VW2
System-On-Chip BCM6358
CPU/Speed BMIPS4350 V1.0 / 300 Mhz BMIPS Dual Core
Flash-Chip Spansion S25FL032A (on v1.3 hardware)
Flash size 4 MiB
RAM-Chip DDR-400
RAM size 32 MiB
Wireless Broadcom BCM4351 802.11b/g/n (onboard)
Ethernet Broadcom BCM5325 w/ vlan support swconfig
Internet ADSL2+
USB no
Serial Yes


TD-W8960N is a little tricky to open.

  1. Below 2 rubber feets there are 2 screws - remove them
  2. Using your hands and a small screwdriver, try to open the upper and lower part (both are white) so that you can grab the 2 black laterals and push them a little. Don't force it!
  3. Near the leds, there are 2 snaps. Using a flat screwdriver, try to open them from the inside. If you don't have space, check if the 2 antenna cables are stuck on any capacitor.
  4. The front part should be now loose and all you need is to pull the white upper cover.

port.serial general information about the serial port, serial port cable, etc.

Pin: TX,RX,GND,VCC (3.3v)

Don't connect VCC! Just use TX,RX and GND and then power on the device.
Also, you MUST short those 2 pads marked in yellow to enable serial RX and TX.
Don't forget that RX connects to the RS232TTL-TX and TX to the RS232TTL-RX!

Serial connection parameters
for TP-Link TD-W8960N
115200, 8N1

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port

Because TD-W8960N is an unit that gets way too hot, adding 2 heatsinks is a good idea.

  1. Add 1 heatsink to the cpu (look at the above image, it's the big square chip on the center)
  2. Add 1 heatsink to the switch (also look at the above image, it's the left chip with “broadcom” written on it)

This should prevent any overheating signs.

# cat /proc/cpuinfo system type : 96358VW2 processor : 0 cpu model : BCM6358 V1.0 BogoMIPS : 297.98 wait instruction : no microsecond timers : yes tlb_entries : 32 extra interrupt vector : no hardware watchpoint : no ASEs implemented : VCED exceptions : not available VCEI exceptions : not available unaligned exceptions : 8260 # cat /proc/mtd dev: size erasesize name mtd0: 00313000 00313000 "Physically mapped flash" # cat /proc/partitions major minor #blocks name 31 0 3148 mtdblock0 # cat /proc/meminfo MemTotal: 29820 kB MemFree: 9148 kB Buffers: 2320 kB Cached: 7860 kB SwapCached: 0 kB Active: 6868 kB Inactive: 6576 kB SwapTotal: 0 kB SwapFree: 0 kB Dirty: 0 kB Writeback: 0 kB AnonPages: 3276 kB Mapped: 2684 kB Slab: 3092 kB SReclaimable: 508 kB SUnreclaim: 2584 kB PageTables: 384 kB NFS_Unstable: 0 kB Bounce: 0 kB CommitLimit: 14908 kB Committed_AS: 7320 kB VmallocTotal: 1032148 kB VmallocUsed: 1732 kB VmallocChunk: 1029348 kB # cat /proc/version Linux version (root@localhost.localdomain) (gcc version 4.2.3) #4 Fri Oct 28 18:30:25 CST 2011 --------------------------------------------------------------------- Logs at boot time (RS232ttl) CFE version 1.0.37-102.9 for BCM96358 (32bit,SP,BE) Build Date: äş 12ć 29 20:10:30 CST 2009 (root@localhost.localdomain) Copyright (C) 2000-2009 Broadcom Corporation. Serial flash device: name S25FL032A, id 0x0115, size 4096KB CPU type 0x2A010: 300MHz, Bus: 133MHz, Ref: 64MHz CPU running TP0 Total memory: 33554432 bytes (32MB) Boot Address 0xbfc00000 Param0 : Param1 : Param2 : Param3 : f Param4 : vmlinux Param5 : bcm963xx_fs_kernel Param6 : 1 Param7 : 0 Num = 8;gNumBootParams = 8 Board IP address : Host IP address : Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id (0-5) : 96358VW2 Number of MAC Addresses (1-32) : 11 Base MAC Address : 00:23:cd:##:##:## PSI Size (1-64) KBytes : 24 Main Thread Number [0|1] : 0 Device Pin : "#######" * * * Press any key to stop auto run (1 seconds) * * * Auto run second count down: 1 web info: Waiting for connection on socket 0. CFE> CFE> help Available commands: sm Set memory or registers. dm Dump memory or registers. w Write the whole image start from beginning of the flash e Erase [n]vram or [a]ll flash except bootrom r Run program from flash image or from host depend on [f/h] flag p Print boot line and board parameter info c Change booline parameters f Write image to the flash i Erase persistent storage data b Change board parameters reset Reset the board flashimage Flashes a compressed image after the bootloader. help Obtain help for CFE commands For more information about a command, enter 'help command-name' * * * command status = 0

CFE> Booting from only image (0xbfc10000) ... Code Address: 0x80010000, Entry Address: 0x8021a000 Decompression OK! Entry at 0x8021a000 Closing network. Closing DMA Channels. Starting program at 0x8021a000 Linux version (root@localhost.localdomain) (gcc version 4.2.3) #2 Wed Aug 25 17:14:28 CST 2010 Serial flash device: name S25FL032A, id 0x0115, size 4096KB 96358VW2 prom init CPU revision is: 0002a010 Determined physical RAM map: memory: 01fa0000 @ 00000000 (usable) On node 0 totalpages: 8096 DMA zone: 32 pages used for memmap DMA zone: 0 pages reserved DMA zone: 4064 pages, LIFO batch:0 Normal zone: 31 pages used for memmap Normal zone: 3969 pages, LIFO batch:0 Built 1 zonelists. Total pages: 8033 Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200 brcm mips: enabling icache and dcache... Primary instruction cache 32kB, physically tagged, 2-way, linesize 16 bytes. Primary data cache 16kB, 2-way, linesize 16 bytes. Synthesized TLB refill handler (21 instructions). Synthesized TLB load handler fastpath (33 instructions). Synthesized TLB store handler fastpath (33 instructions). Synthesized TLB modify handler fastpath (32 instructions). PID hash table entries: 128 (order: 7, 512 bytes) Using 150.000 MHz high precision timer. Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Memory: 29732k/32384k available (1762k kernel code, 2652k reserved, 321k data, 88k init, 0k highmem) KLOB Pool 1 Initialized: 1048576 bytes Calibrating delay loop... 297.98 BogoMIPS (lpj=148992) Mount-cache hash table entries: 512 NET: Registered protocol family 16 Total Flash size: 4096K with 64 sectors File system address: 0xbfc10100 registering PCI controller with io_map_base unset BLOG v1.0 Initialized NET: Registered protocol family 8 NET: Registered protocol family 20 Time: MIPS clocksource has been installed. NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 1024 (order: 1, 8192 bytes) TCP bind hash table entries: 1024 (order: 0, 4096 bytes) TCP: Hash tables configured (established 1024 bind 1024) TCP reno registered squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher squashfs: LZMA suppport for by jro io scheduler noop registered (default) PPP generic driver version 2.4.2 NET: Registered protocol family 24 bcm963xx_mtd driver v1.0 brcmboard: brcm_board_init entry SES: Button Interrupt 0x3 is enabled SES: LED GPIO 0x4 is enabled irq.c: reset_fac_irq is set to low_trigger. Serial: BCM63XX driver $Revision: 3.00 $ ttyS0 at MMIO 0xfffe0100 (irq = 10) is a BCM63XX ttyS1 at MMIO 0xfffe0120 (irq = 11) is a BCM63XX bcmxtmrt: Broadcom BCM6358A1 ATM Network Device v0.1 Aug 25 2010 17:14:19 TCP cubic registered Initializing XFRM netlink socket NET: Registered protocol family 1 NET: Registered protocol family 17 NET: Registered protocol family 15 Ebtables v2.0 registered 802.1Q VLAN Support v1.8 Ben Greear All bugs added by David S. Miller VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 88k freed init started: BusyBox v1.00 (2010.08.12-01:27+0000) multi-call binary BusyBox v1.00 (2010.08.12-01:27+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands. Loading drivers and kernel modules... pktflow: module license 'Proprietary' taints kernel. Broadcom Packet Flow Cache learning via BLOG enabled. Created Proc FS /procfs/fcache Constructed Broadcom Packet Flow Cache v0.1 Feb 26 2009 14:21:08 bcmxtmcfg: bcmxtmcfg_init entry adsl: adsl_init entry Broadcom BCMPROCFS v1.0 initialized Broadcom BCM6358A1 Ethernet Network Device v0.3 Aug 25 2010 17:14:08 Config Ethernet Switch Through MDIO Pseudo PHY Interface ethsw: found bcm5325e! dgasp: kerSysRegisterDyingGaspHandler: eth0 registered rate ctrl page 0x35, addr 0x02: 0 8021x_1 page 0x0A, addr 0x4C: 0 8021x_2 page 0x0A, addr 0x4E: 0 eth0: MAC Address: 00:23:CD:20:16:FF PCI: Enabling device 0000:00:01.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:01.0 to 64 wl0: Broadcom BCM4351 802.11 Wireless Controller dgasp: kerSysRegisterDyingGaspHandler: wl0 registered ===== Release Version 4.02L.03 (build timestamp 100825_1906) ===== wl_cnt= 1 device eth0 is not a slave of br0 device eth0 entered promiscuous mode br0: port 1(eth0) entering learning state br0: topology change detected, propagating br0: port 1(eth0) entering forwarding state WLmngr Daemon is running optarg=0 shmId=0 device wl0 is not a slave of br0 device wl0 entered promiscuous mode br0: port 2(wl0) entering learning state br0: topology change detected, propagating br0: port 2(wl0) entering forwarding state BcmAdsl_Initialize=0xC006B1F8, g_pFnNotifyCallback=0xC0088744 AnnexCParam=0x00000000 AnnexAParam=0x00000980 adsl2=0x00000000 KLOB extended to 2 pools pSdramPHY=0xA1FFFFF8, 0xBE9A 0xDEADBEEF AdslCoreSharedMemInit: shareMemAvailable=21712 AdslCoreHwReset: AdslOemDataAddr = 0xA1FEF96C AnnexCParam=0x00000000 AnnexAParam=0x00000980 adsl2=0x00000000 dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered KLOB extended to 3 pools KLOB extended to 4 pools KLOB extended to 5 pools KLOB extended to 6 pools KLOB extended to 7 pools KLOB extended to 8 pools wlctl -i wl0 phytype > /var/wl0 wlctl -i wl0 revinfo > /var/wl0 wlctl -i wl0 bands > /var/wl0bands wlctl ver > /var/wlver wlctl -i wl0 cap > /var/wl0cap device wl0 left promiscuous mode br0: port 2(wl0) entering disabled state device wl0 is not a slave of br0 device wl0 entered promiscuous mode br0: port 2(wl0) entering learning state br0: topology change detected, propagating br0: port 2(wl0) entering forwarding state interface wl0.1 does not exist! interface wl0.2 does not exist! interface wl0.3 does not exist! Scratch pad is not initialized. br0: port 2(wl0) entering disabled state WPS Device PIN = 23402034 wlctl -i wl0 phy_watchdog 0 wlctl -i wl0 wds none wlctl -i wl0 up wlctl -i wl0 down wlctl -i wl0 mbss 0 wlctl -i wl0 bss -C 0 down wlctl -i wl0 bss -C 1 down wlctl -i wl0 bss -C 2 down wlctl -i wl0 bss -C 3 down wlctl -i wl0 ssid -C 0 's''k''y' Setting SSID "sky" wlctl -i wl0 ssid -C 1 'w''l''0''_''G''u''e''s''t''1' Setting SSID "wl0_Guest1" wlctl -i wl0 ssid -C 2 'w''l''0''_''G''u''e''s''t''2' Setting SSID "wl0_Guest2" wlctl -i wl0 ssid -C 3 'w''l''0''_''G''u''e''s''t''3' Setting SSID "wl0_Guest3" wlctl -i wl0 cur_etheraddr 00:23:CD:20:16:FF 2>/dev/null wlctl -i wl0.1 cur_etheraddr 00:23:CD:20:16:FF 2>/dev/null wlctl -i wl0.2 cur_etheraddr 00:23:CD:20:16:FF 2>/dev/null wlctl -i wl0.3 cur_etheraddr 00:23:CD:20:16:FF 2>/dev/null wlctl -i wl0 ap 1 wlctl -i wl0 infra 1 wlctl -i wl0 closed 0 wlctl -i wl0 country PL wlctl -i wl0 band b wlctl -i wl0 regulatory 0 wlctl -i wl0 radar 0 2>/dev/null wlctl -i wl0 spect 0 2>/dev/null wlctl -i wl0 nmode -1 wlctl -i wl0 mimo_bw_cap 1 wlctl -i wl0 chanspec -c 7 -b 2 -w 40 -s -1 Chanspec set to 0x2d07 wlctl -i wl0 wpa_cap -C 0 > /var/wpa_cap0 wlctl -i wl0 wpa_cap -C 0 0 2>/dev/null wlctl -i wl0 wpa_cap -C 1 > /var/wpa_cap0 wlctl -i wl0 wpa_cap -C 1 0 2>/dev/null wlctl -i wl0 wpa_cap -C 2 > /var/wpa_cap0 wlctl -i wl0 wpa_cap -C 2 0 2>/dev/null wlctl -i wl0 wpa_cap -C 3 > /var/wpa_cap0 wlctl: Unsupported wlctl -i wl0 wpa_cap -C 3 0 2>/dev/null wlctl -i wl0 maxassoc 50 wlctl -i wl0 bss_maxassoc 50 wlctl -i wl0 gmode Auto wlctl -i wl0 gmode_protection_override -1 wlctl -i wl0 gmode_protection_control 2 wlctl -i wl0 nmode_protection_override -1 wlctl -i wl0 protection_control 2 wlctl -i wl0 nreqd 0 wlctl -i wl0 wme 0 2>/dev/null wlctl -i wl0 afterburner_override 0 2>/dev/null wlctl -i wl0 ampdu 1 wlctl -i wl0 amsdu 1 wlctl -i wl0 afterburner_override 0 wlctl -i wl0 wme 1 2>/dev/null wlctl -i wl0 wme_noack 0 2>/dev/null wlctl -i wl0 wme_apsd 1 2>/dev/null wlctl -i wl0 wme_bss_disable 0 wlctl -i wl0 rate 0 wlctl -i wl0 bg_rate 0 wlctl -i wl0 leddc 0 2>/dev/null wlctl -i wl0 mrate -1 wlctl -i wl0 bg_mrate -1 wlctl -i wl0 rateset default wlctl -i wl0 rtsthresh 2347 wlctl -i wl0 fragthresh 2346 wlctl -i wl0 dtim 1 wlctl -i wl0 bi 100 wlctl -i wl0 frameburst 1 wlctl -i wl0 ap_isolate 0 wlctl -i wl0 pwr_percent 100 wlctl -i wl0 wmf_bss_enable 0 wlctl -i wl0.1 wmf_bss_enable 0 wlctl -i wl0.2 wmf_bss_enable 0 wlctl -i wl0.3 wmf_bss_enable 0 wlctl -i wl0 mac none wlctl -i wl0 macmode 0 wlctl -i wl0 up wlctl -i wl0 csscantimer 0 wlctl -i wl0 chanspec > /var/curchaspec0 br0: port 2(wl0) entering learning state br0: topology change detected, propagating br0: port 2(wl0) entering forwarding state device wl0 left promiscuous mode br0: port 2(wl0) entering disabled state device wl0 is not a slave of br0 device wl0 entered promiscuous mode br0: port 2(wl0) entering learning state br0: topology change detected, propagating br0: port 2(wl0) entering forwarding state device wl0.1 is not a slave of br0 device wl0.2 is not a slave of br0 device wl0.3 is not a slave of br0 Reaped 415 UPnP::upnp_init:UPnP daemon is ready to run UPnP::upnp_request_handler:UPNP_CMD_DEV_ADD UPnP::upnp_device_attach:br0: attach WFADevice.xml UPnP::upnp_request_handler:Device command.

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/02/12 08:58
  • by